Me API Documentation

Who the token belongs to, what it may do, and the account itself: its name and password, its API token, the browsers signed in as it and the applications connected to it.

Reading is open to any token. Changing the account, replacing the API token, and ending sessions or connections take an API token or the catalog_admin scope.

Endpoints

GET /api/v1/me

Retrieve the user the token belongs to. Takes no parameters. A client can call this once after signing in to show the user’s name and to learn which scopes an OAuth token was granted.

curl https://app.spondulix.ai/api/v1/me \
  -H "Authorization: Bearer your-api-token-here"

Response

{
    "id": 9,
    "name": "Floyd Lawson",
    "email": "[email protected]",
    "company_name": "Floyd's Barber Shop",
    "scopes": ["catalog", "search", "catalog_write"],
    "libraries_count": 1,
    "auth_token_hint": "…/PfD"
}

Response Fields

HTTP Response Codes

PUT /api/v1/me

Change the account. PATCH works the same way, and only the fields you send change.

Request Body

Wrap the fields in a user key.

{ "user": { "name": "Floyd Lawson", "company_name": "Floyd's Barber Shop" } }

Response

Returns the account as GET does.

HTTP Response Codes

POST /api/v1/me/reset_auth_token

Replace the API token. No body.

The old token stops working at once, everywhere it is used. The new one is in this answer and nowhere else, ever: keep it before doing anything else. A client that calls this with the API token is, from the next request, using a token that no longer works.

Response

{ "auth_token": "..." }

HTTP Response Codes

GET /api/v1/me/sessions

Retrieve the browser sessions signed in as this user, oldest first. Not paged.

Response

{
    "sessions": [
        {
            "id": 44,
            "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) ...",
            "ip_address": "203.0.113.7",
            "created_at": "2026-09-28T08:12:03.115-05:00",
            "updated_at": "2026-09-29T10:40:51.902-05:00"
        }
    ]
}

HTTP Response Codes

DELETE /api/v1/me/sessions/{id}

Sign that browser out.

Path Parameters

Response

(no response body)

HTTP Response Codes

GET /api/v1/me/connected_apps

Retrieve the OAuth applications that hold a token of the user’s that has not been revoked. Not paged.

Response

{
    "connected_apps": [
        { "id": 3, "name": "Spondulix CLI (floyds-mac)", "uid": "b1c2d3e4f5..." }
    ]
}

HTTP Response Codes

DELETE /api/v1/me/connected_apps/{id}

Disconnect an application: every token it holds for the user is revoked, and it must sign in again to reconnect.

Path Parameters

Response

(no response body)

HTTP Response Codes